Versions of k8s prior to 1.14 do not support the nullable field in
CRD properties. As k8s 1.13 remains part of our support matrix and
as this field must remain nullable, we must remove CRD validation
of SecurePort. Range validation of this field has been moved into
the logic of rgw.validateStore.
Fixes: #4693
Signed-off-by: Elise Gafford <egafford@redhat.com>
If an image is specified in the external cluster CR, the
'rook-ceph-config' config map will be created and then child CRs like
rgw/mds/nfs can be created.
Also, calling config.GetStore() was a mistake since it's calling by the
health check if new mons are being added to clusterInfo.
Closes: https://github.com/rook/rook/issues/4686
Signed-off-by: Sébastien Han <seb@redhat.com>
Currently each time the ceph operator restart, osds also restart.
This is due to a change in the crush-location args with location not ordered
At each restart the location order can change and lead to that kind of change in the osd deployment
104c105
< "--crush-location=root=default host=hostname datacenter=PAR pod=2 rack=2",
---
> "--crush-location=root=default host=hostname pod=2 rack=2 datacenter=PAR",
Sorting the topology to ensure stability of this command arg
Signed-off-by: n.fraison <n.fraison@criteo.com>
Now, we purely rely on what the user puts in the CR and apply it.
Prior to this commit we were putting 0 if not declared, this was not the
intentional.
Closes: https://github.com/rook/rook/issues/4713
Signed-off-by: Sébastien Han <seb@redhat.com>
We now force the mds daemon to join the fs that was created by Rook.
This can always be changed by using the ceph config store.
Closes: https://github.com/rook/rook/issues/4707
Signed-off-by: Sébastien Han <seb@redhat.com>
If all mons are down (e.g. set the replicas to 0 on all the mon deployments) and the operator is restarted, the operator waits indefinitely for a single mon to start. This PR fixes this issue by skipping the quorum check of mons if the number of ready mon pods is equal to 0.
Signed-off-by: Ashish Ranjan <ashishranjan738@gmail.com>
When the OSDs are being provisioned,
if one cluster has already provisioned the OSDs,
the new cluster will skip them since it will see they are already in use.
So we don't need this check anymore.
Coordinating the flag across multiple cluster instances is more complicated than it's worth.
Someone also might want useAllDevices: true in multiple clusters
and they would keep them on separate nodes by using the node labels and selectors.
Closes: https://github.com/rook/rook/issues/4633
Signed-off-by: Sébastien Han <seb@redhat.com>
A new CR setting has been introduced to disable the crash controller.
To disable it, add `disable: true` on the crashCollector section.
Signed-off-by: Sébastien Han <seb@redhat.com>
Added a check for --crush-location, if --crush-location is not present,
the node topology is not applied and the operator will need to determine
the value based on the node labels instead of skipping this setting.
Signed-off-by: rohan47 <rohgupta@redhat.com>
The host name of an OSD in the CRUSH map should be the real
host name for non-portable OSDs. It was incorrectly being set
to the PVC name. Now the non-portable OSDs based on PVCs will
corretly have the host name set to the node name.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The method to construct osd environment variables is simplified
by passing a struct param instead of individual params
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The minio operator has not had community support nor
any updates since being added to Rook. Support is being
removed from Rook due to this lack of community interest.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
A new CRD option `continueUpgradeAfterChecksEvenIfNotHealthy` is added.
When upgrading, Rook goes OSD by OSD and then waits for PGs to be clean
before proceeding to the next OSD. Currently, Rook waits for 5 hours but
there might be circumstances where PGs need more time to settle.
Thus setting `continueUpgradeAfterChecksEvenIfNotHealthy` to true will
pursue the upgrade process, even if PGs are not 100% active+clean.
Closes: https://bugzilla.redhat.com/show_bug.cgi?id=1786029
Signed-off-by: Sébastien Han <seb@redhat.com>
Add support for the k8s 1.17 official zone/region failure domain labels.
Our earlier guess that the official labels would be
<failure-domain.kubernetes.io> was wrong; the official is now
<topology.kubernetes.io>.
Signed-off-by: Blaine Gardner <blaine.gardner@suse.com>
The operator kit had more utility originally when the operator
was creating and managing the TPRs and CRDs directly. Since
the CRDs are now created from a manifest and no longer by the
operators, the utility of operator kit is limited to the
controller watcher. Since we are moving to the controller runtime
we simplify the code to make the transition smoother. Now
there is only a simple WatchCR method that will need to be
replaced as we maek that transition.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Replaced `math/rand` with more secure `crypto/rand` which will generate CSPRNG.
Changed the length of dashboard password from 10 to 20 and included more special characters that can strengthen password.
Passwords before this change: QoMmqLkaOf,8tqTyWF1sZ
Passwords after this change: L{QZ@_c'Rl7$uvW:UHU1, fP-OjX`UVw0J0Ka/scS(
Resolves: https://github.com/rook/rook/issues/4571
Signed-off-by: Nizamudeen <nia@redhat.com>
If obj is not successfully cast into an e dgefsv1.Cluster, ok will be false, resulting in the .Update(cluster) operation not running, and the declared err variable retaining its default nil value. Subsequently, a check against err is performed, which will evaluate to false, resulting in logging the finalizer as removed when it in fact was not.
Signed-off-by: Nizamudeen <nia@redhat.com>
security issues identified by TrailOfBits:
Improperly handled type assertion error could result in invalid
execution state.
If we obtain an error trying to get a Node object is better not
continue executing this function.
Resolves#4567
Signed-off-by: Juan Miguel Olmo Martínez <jolmomar@redhat.com>
"ceph-volume activate" on encrypted osds needs a ceph.conf as well as
connectivity to the mons. This commit adds that to that "activate-osd"
init container.
Closes: https://github.com/rook/rook/issues/4558
Signed-off-by: Sébastien Han <seb@redhat.com>
The OSDs on PVCs were changing location in the CRUSH
hierarchy after an operator restart due to the location
property not being re-discovered on the OSD daemon.
Since OSDs on PVCs do not run the prepare pod again
to discover this property, the operator must read it
off the existing osd deployment. The operator was
reading other properties, but now will read the location
as well.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The isUpgrade flag was being set every time the operator
was started. This caused the upgrade checks to be run every
time the operator restarted. Thus, if any mons were down,
you likely would get stuck on the upgrade checks since another
mon could not be stopped. We need to rely on the upgrade being
detected either by a different image name from the cluster CR
update, or from different versions of the daemons running
in case the operator was restarted in the middle of an upgrade.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
This commit adds status field for ceph related CRs which will be useful for knowing the ceph component status without checking the logs.
Signed-off-by: Ashish Ranjan <ashishranjan738@gmail.com>
CSI nodeplugins, specifically when using cephfs FUSE or
rbd-nbd as the mounters, when upgraded, will
cause existing mounts to become stale/not-rechable
(usually connection timeout errors).
This is due to losing the mount processes running within the
CSI nodeplugin pods.
This PR add updated the Daemonset update strategy
based on the ENV variable to take care of above issue
with some manual steps
Moreinfo: https://github.com/ceph/ceph-csi/issues/703
Resolves: https://github.com/rook/rook/issues/4248
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
Elise Gafford
Sébastien Han
Elias Wimmer
n.fraison
Travis Nielsen
Ashish Ranjan
rohan47
Arnav Agarwal
Dmitry Yusupov
Blaine Gardner
Nizamudeen
Juan Miguel Olmo Martínez
Madhu Rajanna